Skip to main content

User Management

The Administration > Users page displays all users who have authenticated with Symphony, their group memberships, and their resolved roles.

Viewing Users​

Navigate to Administration > Users to see a list of all known users. Each entry shows:

ColumnDescription
SubjectThe OIDC subject identifier (user ID or email)
GroupsGroup memberships from the identity provider's token
RolesResolved roles based on group-to-role assignments
PermissionsEffective publish and subscribe permissions (union of all roles)

Understanding Resolved Roles​

A user's roles are determined by the RBAC system:

  1. Symphony reads the groups claim from the user's OIDC token.
  2. Each group is matched against role assignments configured in Administration > Assignments.
  3. The user receives the union of all roles from all matched groups.
  4. If no groups match any assignment, the default_role (typically viewer) is applied.

Users in the configured admin_group (or matching admin_subject) automatically receive the symphony-admin role.

Bootstrap Mode​

When neither admin_group nor admin_subject is configured in symphony.config, Symphony operates in bootstrap mode:

  • All authenticated users have full administrator access
  • The Administration menu is visible to everyone
  • A warning banner is displayed in the UI (unless "bootstrap": true is set in the rbac configuration)

This allows initial setup before an administrator has been designated. To exit bootstrap mode, configure RBAC as described in the RBAC guide.

warning

In bootstrap mode, any authenticated user can modify roles, assignments, licenses, and other administrative settings. Configure RBAC as soon as your identity provider groups are ready.

See Also​